cli: avoid buffer overrun